Free cookie consent banner generator

What the law actually requires

Cookies in the UK sit under PECR, alongside UK GDPR. PECR decides when you need consent to set a cookie; UK GDPR decides what that consent must look like. Importantly, PECR applies whether or not the cookie holds personal data — an anonymous analytics cookie still needs consent.

The four rules a banner must follow

• Set nothing before consent. Non-essential cookies must not be written until the visitor agrees. A banner over scripts that already fired is decoration.
• Refusing must be as easy as accepting. An “Accept all” button with no equally prominent reject option is the most commonly enforced failure.
• No pre-ticked boxes. Silence and inaction are not consent.
• Consent must be withdrawable as easily as it was given — usually a persistent footer link.

Which cookies are exempt

Strictly necessary cookies need no consent: the session that keeps someone logged in, the shopping basket, the record of the consent choice itself. The test is whether the service the visitor actually asked for would work without it.

Why cookies still appear after adding a banner

Because the tags are in your page head. Google Analytics, Meta Pixel and advertising scripts fire on page load, before anyone has clicked anything. Adding a banner does not stop them — they have to be held back and triggered by the consent event instead.

Check it yourself: open your site in a private window and look at Application → Cookies in your browser’s developer tools before touching the banner. Anything present at that moment was set without consent.

Recording consent

You should be able to demonstrate that consent was given, and to what. Storing the choice and its date is proportionate for a small site. If you cannot evidence consent, for practical purposes you do not have it.

Common questions

Do I need a cookie banner in the UK?

If your site sets any non-essential cookies — analytics, advertising, embedded media — then yes, and consent must be obtained before they are set.

Do analytics cookies need consent?

Yes. Analytics is not strictly necessary under PECR because it serves the site owner rather than the visitor's task.

Can my banner only have an Accept button?

No. Refusing must be as easy as accepting. Accept-only banners are the most commonly enforced compliance failure.

Why do cookies appear before I click the banner?

Your tracking scripts are firing on page load. They need to be held back and triggered by the consent event rather than running in the page head.